total-recall-brain 3.41.6 → 3.42.0

package/scaffold/.agent/skills/total-recall/plugins/auth/package.json

@@ -5,7 +5,8 @@
   "type": "module",
   "main": "cli.mjs",
   "scripts": {
-    "test": "node --test test/*.test.mjs && vitest run test"
+    "test": "node --test test/*.test.mjs && vitest run test",
+    "ssss": "ssss"
   },
   "keywords": [
     "total-recall-plugin",
@@ -21,7 +22,8 @@
     "express": "^5.2.1",
     "express-rate-limit": "^8.5.1",
     "jsonwebtoken": "^9.0.3",
-    "yaml": "^2.9.0"
+    "yaml": "^2.9.0",
+    "@gregiteen/ssss-cli": "0.14.4"
   },
   "files": [
     "cli.mjs",
@@ -35,5 +37,8 @@
   ],
   "publishConfig": {
     "access": "public"
+  },
+  "overrides": {
+    "@ssss/cli": "npm:@gregiteen/ssss-cli@0.14.4"
   }
 }

package/scaffold/.agent/skills/total-recall/plugins/auth/src/cli-secret.mjs

@@ -12,6 +12,7 @@
  *   npx total-recall auth secret usage-record --provider x --cost 0.01
  */
 
+import { exitAfterFlush } from './exit-after-flush.mjs';
 import {
   setSecret,
   getSecret,
@@ -242,6 +243,7 @@ function printHelp() {
                             [--dry-run] [--keys k1,k2] [--path <repo>]
       verify <name>        Compare the deployed file with the store by fingerprint
                             (match/differs/missing/duplicate; no values) [--keys] [--path]
+                            --find-fingerprint <fp> names every remote key holding that value
       import-pm2 <name>    Move named keys from a pm2 app's captured env into the store
                             --app <pm2 name> --keys k1,k2 [--apply] [--overwrite] [--repo r]
     merge-store <dir>     Fold a stray per-repo store into this one (dry run unless --apply).
@@ -251,6 +253,7 @@ function printHelp() {
       --bind-same         Also bind keys whose value already matches (only for an app's own store)
       --dates-from-source Restore an older value date for keys whose value is identical
     diff-env              Compare repo .env files against the store (no values printed)
+      --find-fingerprint <fp>  Instead, name every key holding that value
       --path <dir>        Single repo (default: every project-registry path)
       --filename .env     File to compare (default .env; server/<name> also checked)
       --strict            Exit 1 on any drift or unadopted key
@@ -299,6 +302,10 @@ function printHelp() {
       --print-only        Only print instructions
       --headless          Allow headless for verified recipes
     rotate-auto <key>     Rotate by whatever method the key's class supports
+    provider-keys <provider>  List the provider account's keys (no values) and which
+                           store names hold them; a key held by none is stale
+      --revoke <hash>     Revoke one key the store no longer holds
+      --json              Machine-readable output
     rotation-status       Rotation coverage for every key in the vault
       --json              Machine-readable output
     browser-logout        Delete TR's persistent browser profile (all sessions)
@@ -415,6 +422,7 @@ function parseArgs(args) {
       'meta',
       'rotate-browser',
       'rotate-auto',
+      'provider-keys',
       'rm',
       'generate',
       'account-sync',
@@ -609,6 +617,12 @@ function parseArgs(args) {
       case '--chrome':
         out.chrome = true;
         break;
+      case '--find-fingerprint':
+        out.findFingerprint = args[++i];
+        break;
+      case '--revoke':
+        out.revokeHash = args[++i];
+        break;
       case '--revoke-old':
         out.revokeOld = true;
         break;
@@ -722,7 +736,7 @@ export default async function secretCli(argv) {
     opts = parseArgs(remainingArgs);
   } catch (err) {
     console.error(`❌ ${err.message}`);
-    process.exit(1);
+    await exitAfterFlush(1);
   }
   if (opts.help || !opts.command) {
     printHelp();
@@ -734,23 +748,23 @@ export default async function secretCli(argv) {
   // one. Repo binding lives in each key's metadata (`meta <key> --repo`).
   if (layer === 'project') {
     console.error('❌ Secrets have one store; --project does not apply. Bind a key to a repo with `auth secret meta <key> --repo <name>`.');
-    process.exit(1);
+    await exitAfterFlush(1);
   }
   const brainDir = secretsStoreDir();
 
   if (opts.stdin && opts.command !== 'fingerprint') {
     if (!['set', 'rotate', 'rekey'].includes(opts.command)) {
       console.error('❌ --stdin is only valid with `set`, `rotate`, `rekey`, or `fingerprint`');
-      process.exit(1);
+      await exitAfterFlush(1);
     }
     if (opts.command !== 'rekey' && !opts.key) {
       console.error(`Usage: total-recall auth secret ${opts.command} <key> --stdin`);
-      process.exit(1);
+      await exitAfterFlush(1);
     }
     opts.value = readStdinValue();
     if (!opts.value) {
       console.error('❌ --stdin read an empty value');
-      process.exit(1);
+      await exitAfterFlush(1);
     }
   }
 
@@ -798,7 +812,7 @@ export default async function secretCli(argv) {
         console.error(
           '❌ No persistent master-password carrier found. Use --launch-agent <path>, --env-file <path> or --keychain <service>.',
         );
-        process.exit(1);
+        await exitAfterFlush(1);
       }
 
       const currentPasswords = [
@@ -808,12 +822,12 @@ export default async function secretCli(argv) {
       const oldPassword = currentPasswords[0] || process.env.TR_SECRETS_PASSWORD;
       if (!oldPassword) {
         console.error('❌ The current master password is unavailable from the selected carriers.');
-        process.exit(1);
+        await exitAfterFlush(1);
       }
       if (currentPasswords.some((value) => value !== oldPassword)) {
         console.error('❌ Selected credential carriers do not contain the same current master password.');
         console.error('   Every carrier must hold the same password before one can replace it.');
-        process.exit(1);
+        await exitAfterFlush(1);
       }
 
       const defaultBrainDirs = [
@@ -848,7 +862,7 @@ export default async function secretCli(argv) {
     if (opts.command === 'set') {
       if (!opts.key || opts.value == null) {
         console.error('Usage: total-recall auth secret set <key> <value>');
-        process.exit(1);
+        await exitAfterFlush(1);
       }
       const setKey = await resolveSecretKey(brainDir, opts.key, currentRepoName());
       await setSecret(brainDir, setKey, opts.value, {
@@ -877,7 +891,7 @@ export default async function secretCli(argv) {
     if (opts.command === 'generate') {
       if (!opts.key) {
         console.error('Usage: total-recall auth secret generate <key> [--bytes 32] [--format hex|base64|base64url]');
-        process.exit(1);
+        await exitAfterFlush(1);
       }
       const crypto = await import('node:crypto');
       const val = crypto.randomBytes(opts.bytes).toString(opts.format);
@@ -1005,7 +1019,7 @@ export default async function secretCli(argv) {
         if (r.usage) console.log(`     usage: ${JSON.stringify(r.usage)}`);
         if (r.subscription) console.log(`     subscription: ${JSON.stringify(r.subscription)}`);
         console.log('');
-        if (r.tracking_status === 'error') process.exit(1);
+        if (r.tracking_status === 'error') await exitAfterFlush(1);
         return;
       }
       console.log('\n  🔄 Live provider account/usage sync (all set secrets)…\n');
@@ -1025,7 +1039,7 @@ export default async function secretCli(argv) {
       console.log(
         `\n  tracking-health: healthy=${health.healthy} ok=${health.ok} exempt=${health.exempt} errors=${health.errors}\n`,
       );
-      if (!report.healthy) process.exit(1);
+      if (!report.healthy) await exitAfterFlush(1);
       return;
     }
 
@@ -1049,7 +1063,7 @@ export default async function secretCli(argv) {
         }
       }
       console.log('');
-      if (!health.healthy || !shared.healthy) process.exit(1);
+      if (!health.healthy || !shared.healthy) await exitAfterFlush(1);
       return;
     }
 
@@ -1095,14 +1109,14 @@ export default async function secretCli(argv) {
       } else {
         console.log('\n  No shared credential values detected.\n');
       }
-      if (!shared.healthy) process.exit(1);
+      if (!shared.healthy) await exitAfterFlush(1);
       return;
     }
 
     if (opts.command === 'meta') {
       if (!opts.key) {
         console.error('Usage: total-recall auth secret meta <key> [--repo ...] [--tier ...]');
-        process.exit(1);
+        await exitAfterFlush(1);
       }
       const patch = {};
       if (opts.repos.length) patch.repos = opts.repos;
@@ -1110,7 +1124,7 @@ export default async function secretCli(argv) {
         const row = (await listSecretsMeta(brainDir)).find((r) => r.key === opts.key);
         if (!row) {
           console.error(`❌ Secret not found: ${opts.key}`);
-          process.exit(1);
+          await exitAfterFlush(1);
         }
         patch.repos = (patch.repos || row.repos || []).filter((r) => !opts.unbind.includes(r));
       }
@@ -1174,7 +1188,7 @@ export default async function secretCli(argv) {
     if (opts.command === 'get') {
       if (!opts.key) {
         console.error('Usage: total-recall auth secret get <key>');
-        process.exit(1);
+        await exitAfterFlush(1);
       }
       const project_id = currentProjectId();
       const resolved = await resolveSecretKey(brainDir, opts.key, currentRepoName());
@@ -1185,7 +1199,7 @@ export default async function secretCli(argv) {
       }
       if (!r.found) {
         console.error(`  Secret not found: ${opts.key}`);
-        process.exit(1);
+        await exitAfterFlush(1);
       }
       // Print value only — user explicitly asked
       console.log(r.value);
@@ -1264,7 +1278,7 @@ export default async function secretCli(argv) {
       const value = opts.fromClipboard ? readSystemClipboard() : opts.stdin ? readStdinValue() : '';
       if (!value) {
         console.error('Usage: total-recall auth secret fingerprint --from-clipboard|--stdin [--expect-prefix <p>] [--not <KEY>] [--json]');
-        process.exit(1);
+        await exitAfterFlush(1);
       }
       const fp = secretValueFingerprint(value);
       const matches = (await listSecretsMeta(brainDir)).filter((row) => row.fingerprint_full === fp).map((row) => row.key);
@@ -1295,7 +1309,7 @@ export default async function secretCli(argv) {
             '  verify <name> [--keys k1,k2] [--path <repo>] [--json]\n' +
             '  import-pm2 <name> --app <pm2 name> --keys k1,k2 [--apply] [--overwrite] [--repo r] [--json]',
         );
-        process.exit(1);
+        await exitAfterFlush(1);
       }
 
       if (opts.subcommand === 'add') {
@@ -1303,7 +1317,7 @@ export default async function secretCli(argv) {
           console.error(
             'Usage: total-recall auth secret remote add <name> --host <host> --path </remote/dir> [--user root] [--port 22] [--filename .env] [--restart-cmd "..."]',
           );
-          process.exit(1);
+          await exitAfterFlush(1);
         }
         const { path: targetsPath } = addRemoteTarget(brainDir, {
           name: opts.key,
@@ -1343,7 +1357,7 @@ export default async function secretCli(argv) {
       if (opts.subcommand === 'remove' || opts.subcommand === 'rm') {
         if (!opts.key) {
           console.error('Usage: total-recall auth secret remote remove <name>');
-          process.exit(1);
+          await exitAfterFlush(1);
         }
         const r = removeRemoteTarget(brainDir, opts.key);
         console.log(r.removed ? `  ✅ Removed remote target: ${opts.key}` : `  Remote target not found: ${opts.key}`);
@@ -1353,7 +1367,7 @@ export default async function secretCli(argv) {
       if (opts.subcommand === 'deploy') {
         if (!opts.key) {
           console.error('Usage: total-recall auth secret remote deploy <name> [--dry-run] [--keys k1,k2]');
-          process.exit(1);
+          await exitAfterFlush(1);
         }
         const r = await deployEnvToRemote(brainDir, opts.key, {
           dryRun: opts.dryRun,
@@ -1376,10 +1390,11 @@ export default async function secretCli(argv) {
       if (opts.subcommand === 'verify') {
         if (!opts.key) {
           console.error('Usage: total-recall auth secret remote verify <name> [--keys k1,k2] [--path <repo>] [--json]');
-          process.exit(1);
+          await exitAfterFlush(1);
         }
         const r = await verifyRemote(brainDir, opts.key, {
           keys: opts.keys.length ? opts.keys : undefined,
+          findFingerprint: opts.findFingerprint,
           projectPath: opts.path ? path.resolve(opts.path) : undefined,
         });
         if (opts.json) console.log(JSON.stringify(r, null, 2));
@@ -1390,6 +1405,7 @@ export default async function secretCli(argv) {
             console.log(`  ${mark} ${row.key.padEnd(36)} ${row.status}${row.duplicates ? ` (+${row.duplicates} duplicate)` : ''}`);
           }
           console.log(`     ${r.remoteOnly.length} key(s) on the remote are not in the projection`);
+          if (r.holders) console.log(`     holders of that fingerprint: ${r.holders.join(', ') || 'none'}`);
           console.log(`     ${r.ok ? 'in sync' : 'DRIFT'} (values compared by fingerprint; none printed)\n`);
         }
         if (!r.ok) process.exitCode = 1;
@@ -1399,7 +1415,7 @@ export default async function secretCli(argv) {
       if (opts.subcommand === 'import-pm2') {
         if (!opts.key || !opts.app || !opts.keys.length) {
           console.error('Usage: total-recall auth secret remote import-pm2 <name> --app <pm2 name> --keys k1,k2 [--apply] [--overwrite] [--repo r] [--json]');
-          process.exit(1);
+          await exitAfterFlush(1);
         }
         const r = await importFromPm2(brainDir, opts.key, {
           app: opts.app,
@@ -1418,14 +1434,14 @@ export default async function secretCli(argv) {
       }
 
       console.error(`Unknown remote subcommand: ${opts.subcommand}`);
-      process.exit(1);
+      await exitAfterFlush(1);
     }
 
     if (opts.command === 'rotate') {
       if (!opts.key) {
         console.error('Usage: total-recall auth secret rotate <key> [--export-env|--export-all|--remote <name>]');
         console.error('       The new value is read from a prompt or stdin — never from argv.');
-        process.exit(1);
+        await exitAfterFlush(1);
       }
       // A credential passed as an argument is disclosed the moment it is typed:
       // argv is readable by any user via `ps`, is saved to shell history, and is
@@ -1439,7 +1455,7 @@ export default async function secretCli(argv) {
         opts.value = readSystemClipboard();
         if (!opts.value) {
           console.error('Error: clipboard is empty — copy the new credential first.');
-          process.exit(1);
+          await exitAfterFlush(1);
         }
         console.log(`  📋 Read ${opts.value.length} chars from the clipboard (value not shown).`);
       }
@@ -1455,7 +1471,7 @@ export default async function secretCli(argv) {
       }
       if (!opts.value) {
         console.error('Error: empty value — aborting rotation.');
-        process.exit(1);
+        await exitAfterFlush(1);
       }
       if (opts.remote) {
         await rotateSecret(brainDir, opts.key, opts.value, { provider: opts.provider, scope: opts.scope });
@@ -1508,7 +1524,7 @@ export default async function secretCli(argv) {
     if (opts.command === 'rotate-browser' || opts.command === 'rotate-auto') {
       if (!opts.key) {
         console.error(`Usage: total-recall auth secret ${opts.command} <key>`);
-        process.exit(1);
+        await exitAfterFlush(1);
       }
 
       if (opts.printOnly) {
@@ -1536,17 +1552,34 @@ export default async function secretCli(argv) {
       if (!r.ok) {
         console.error(`\n  ❌ ${r.error}`);
         if (r.console_url) console.error(`     Console: ${r.console_url}`);
-        process.exit(1);
+        await exitAfterFlush(1);
       }
       console.log(`\n  ✅ Rotated ${r.key}` + (r.method ? ` via ${r.method}` : ''));
       if (r.verified === true) console.log('     verified against provider API');
-      if (r.revoked) console.log(`     revoked ${r.revoked} deprecated credential(s) from provider console`);
+      if (r.revoked?.revoked === true) console.log('     revoked the previous key at the provider');
+      else if (r.revoked?.attempted) console.log(`  ⚠️  The previous key was NOT revoked (${r.revoked.status ? `HTTP ${r.revoked.status}` : r.revoked.error || 'provider refused'}); it is still live.`);
+      else if (r.revoked && typeof r.revoked === 'object') console.log(`  ⚠️  The previous key was NOT revoked and is still live: ${r.revoked.reason}`);
+      else if (typeof r.revoked === 'number' && r.revoked) console.log(`     revoked ${r.revoked} deprecated credential(s) from provider console`);
       if (r.supervised) console.log('     (supervised — recipe not yet auto-verified)');
       if (r.exports?.length) console.log(`     exported to ${r.exports.length} project(s)`);
       if (r.revoke_hint && !r.revoked) console.log(`\n  ⚠️  ${r.revoke_hint}`);
       return;
     }
 
+    if (opts.command === 'provider-keys') {
+      if (!opts.key) {
+        console.error('Usage: total-recall auth secret provider-keys <provider> [--revoke <hash>] [--json]');
+        process.exitCode = 1;
+        return;
+      }
+      const { manageProviderKeys } = await import('./secrets-rotate.mjs');
+      const result = await manageProviderKeys(brainDir, opts.key, { revoke: opts.revokeHash });
+      if (opts.json) console.log(JSON.stringify(result, null, 2));
+      else if (opts.revokeHash) console.log(`\n  ✅ Revoked ${result.name || result.label} (${result.revoked.slice(0, 12)})`);
+      else for (const item of result.keys) console.log(`  ${item.hash.slice(0, 12)}  ${String(item.name || item.label).padEnd(44)} ${item.disabled ? 'disabled' : 'active  '}  ${item.stored_as.length ? item.stored_as.join(',') : 'NOT IN STORE'}`);
+      return;
+    }
+
     if (opts.command === 'rotation-status') {
       const { planAll, summarizePlans } = await import('./rotation-capability.mjs');
       const all = await loadSecrets(brainDir);
@@ -1582,12 +1615,12 @@ export default async function secretCli(argv) {
     if (opts.command === 'delete' || opts.command === 'rm') {
       if (!opts.key) {
         console.error('Usage: total-recall auth secret delete <key>');
-        process.exit(1);
+        await exitAfterFlush(1);
       }
       const r = await deleteSecret(brainDir, opts.key);
       if (!r.found) {
         console.error(`  Secret not found: ${opts.key}`);
-        process.exit(1);
+        await exitAfterFlush(1);
       }
       console.log(`  ✅ Deleted: ${opts.key}`);
       return;
@@ -1724,7 +1757,7 @@ export default async function secretCli(argv) {
     if (opts.command === 'merge-store') {
       if (!opts.key) {
         console.error('❌ Usage: auth secret merge-store <source brain dir> [--repo <name>] [--tags a,b] [--rename SRC=DEST] [--take K1,K2] [--apply] [--json]');
-        process.exit(1);
+        await exitAfterFlush(1);
       }
       const { mergeStore } = await import('./secrets-merge.mjs');
       const report = await mergeStore(brainDir, path.resolve(opts.key), {
@@ -1770,6 +1803,17 @@ export default async function secretCli(argv) {
         return;
       }
 
+      if (opts.findFingerprint) {
+        const { holdersOfFingerprint, parseDotenv } = await import('./secrets-remote-deploy.mjs');
+        const found = files.flatMap((file) => {
+          const name = typeof file === 'string' ? file : file.path;
+          return holdersOfFingerprint(parseDotenv(fs.readFileSync(name, 'utf8')), opts.findFingerprint).map((key) => ({ file: name, key }));
+        });
+        for (const row of found) console.log(`  ${row.file}  ${row.key}`);
+        console.log(`  ${found.length} holder(s) of that fingerprint in ${files.length} file(s)`);
+        return;
+      }
+
       const { totals, rows, storeKeyCount } = await diffEnvAgainstStore(compareBrainDir, files);
 
       console.log(`\n  Secrets store vs .env — ${files.length} file(s), ${storeKeyCount} keys in store`);
@@ -1817,7 +1861,7 @@ export default async function secretCli(argv) {
       console.log('');
       if (opts.strict && (totals.drift > 0 || totals.only_env > 0)) {
         console.error('  diff-env --strict: store is not the source of truth for every key.');
-        process.exit(1);
+        await exitAfterFlush(1);
       }
       return;
     }
@@ -1830,7 +1874,7 @@ export default async function secretCli(argv) {
       if (opts.file) {
         if (!fs.existsSync(opts.file)) {
           console.error(`  File not found: ${opts.file}`);
-          process.exit(1);
+          await exitAfterFlush(1);
         }
         const text = fs.readFileSync(opts.file, 'utf8');
         const map = parseEnvText(text);
@@ -1940,16 +1984,16 @@ export default async function secretCli(argv) {
           console.error(`  ❌ LEAK in ${t.file}: keys ${r.keys.join(', ')}`);
         }
       }
-      if (bad) process.exit(1);
+      if (bad) await exitAfterFlush(1);
       console.log(`  ✅ No secret values found in ${texts.length} surface/openwiki file(s)`);
       return;
     }
 
     console.error(`Unknown secret command: ${opts.command}`);
     printHelp();
-    process.exit(1);
+    await exitAfterFlush(1);
   } catch (err) {
     console.error(`❌ ${err.message}`);
-    process.exit(1);
+    await exitAfterFlush(1);
   }
 }

package/scaffold/.agent/skills/total-recall/plugins/auth/src/exit-after-flush.mjs

@@ -0,0 +1,22 @@
+/**
+ * Exit once everything already written to stdout and stderr has left the process.
+ *
+ * process.exit() drops whatever is still queued. On macOS a pipe write is
+ * asynchronous and the pipe takes 64 KiB at once, so a report followed by
+ * process.exit(1) reaches its reader cut off. The host reads this CLI through a pipe.
+ *
+ * The returned promise never settles, so `await exitAfterFlush(code)` stops the
+ * caller the way process.exit() does. A reader that has gone away is not an error.
+ */
+function drained(stream) {
+  return new Promise((resolve) => {
+    stream.on('error', resolve);
+    if (stream.destroyed || !stream.writable || stream.writableLength === 0) return resolve();
+    stream.write('', resolve);
+  });
+}
+
+export function exitAfterFlush(code = process.exitCode ?? 0) {
+  Promise.all([drained(process.stdout), drained(process.stderr)]).then(() => process.exit(code));
+  return new Promise(() => {});
+}

package/scaffold/.agent/skills/total-recall/plugins/auth/src/provider-api-rotation.mjs

@@ -47,7 +47,7 @@ function pick(obj, dotted) {
  */
 export async function rotateViaProviderApi({
   brainDir, key, managementKeyName, recipe, baseUrl,
-  readSecret, storeSecret, secretMeta, recordKeyId, fetchImpl = fetch,
+  readSecret, storeSecret, secretMeta, listRows, recordKeyId, fetchImpl = fetch,
 }) {
   const management = await readSecret(brainDir, managementKeyName);
   if (!management) {
@@ -87,6 +87,21 @@ export async function rotateViaProviderApi({
     return { ok: false, error: `Could not reach the provider API: ${error.message}` };
   }
 
+  // Read the outgoing key's id before recording the new one, or the revoke would target the new key.
+  const prior = await secretMeta(brainDir, key);
+  let priorId = prior?.provider_key_id || prior?.key_id || null;
+  // A key minted before ids were kept can still be found: the provider's hash is the value's digest.
+  if (!priorId && prior?.fingerprint && recipe.list) {
+    try {
+      const res = await fetchImpl(`${baseUrl}${recipe.list.path}`, { headers: auth });
+      const items = res.ok ? pick(await res.json(), recipe.list.items_path) : null;
+      priorId = (Array.isArray(items) ? items : []).find((item) => String(item.hash).startsWith(prior.fingerprint))?.hash || null;
+    } catch { /* reported below as an unaddressable key */ }
+  }
+  const twins = prior?.fingerprint && listRows
+    ? (await listRows(brainDir)).filter((row) => row.key !== key && row.fingerprint === prior.fingerprint).map((row) => row.key)
+    : [];
+
   // Store first, revoke second.
   let exports;
   try {
@@ -103,7 +118,7 @@ export async function rotateViaProviderApi({
     };
   }
 
-  const revoked = await revokeOld({ auth, recipe, created, secretMeta, brainDir, key, fetchImpl, baseUrl });
+  const revoked = await revokeOld({ auth, recipe, created, priorId, twins, fetchImpl, baseUrl });
 
   return {
     ok: true,
@@ -117,15 +132,14 @@ export async function rotateViaProviderApi({
 }
 
 /** Best-effort revoke of the previous credential; never fails the rotation. */
-async function revokeOld({ auth, recipe, created, secretMeta, brainDir, key, fetchImpl, baseUrl }) {
+async function revokeOld({ auth, recipe, created, priorId, twins = [], fetchImpl, baseUrl }) {
   if (!recipe.revoke) return { attempted: false, reason: 'provider declares no revoke endpoint' };
-  const prior = await secretMeta(brainDir, key);
-  const priorId = prior?.provider_key_id || prior?.key_id || null;
+  if (twins.length) return { attempted: false, reason: `the old value is still stored under ${twins.join(', ')}; rotate those, then revoke it with provider-keys --revoke` };
   if (!priorId) {
     return {
       attempted: false,
       reason: 'the store does not record the previous key id, so the old key cannot be addressed; '
-        + 'revoke it in the provider console',
+        + 'find it with `auth secret provider-keys` and revoke it there',
     };
   }
   try {
@@ -138,3 +152,44 @@ async function revokeOld({ auth, recipe, created, secretMeta, brainDir, key, fet
     return { attempted: true, revoked: false, error: error.message };
   }
 }
+
+async function managementContext(provider, readSecret, brainDir) {
+  const api = provider?.rotation?.api;
+  if (!api?.list || !api?.revoke) throw new Error(`${provider?.name || 'This provider'} declares no key-management API`);
+  const management = await readSecret(brainDir, provider.rotation.management_key);
+  if (!management) throw new Error(`No management credential in the store: ${provider.rotation.management_key}`);
+  return { api, auth: { Authorization: `Bearer ${management}` } };
+}
+
+/** Every key on the provider account, marked with the store names holding it. No key value is ever returned. */
+export async function listProviderKeys({ brainDir, provider, readSecret, listRows, fetchImpl = fetch }) {
+  const { api, auth } = await managementContext(provider, readSecret, brainDir);
+  const rows = await listRows(brainDir);
+  const keys = [];
+  for (let offset = 0; ; offset += api.list.page_size) {
+    const res = await fetchImpl(`${api.base_url}${api.list.path}?offset=${offset}`, { headers: auth });
+    if (!res.ok) throw new Error(`Provider refused to list keys (HTTP ${res.status})`);
+    const page = pick(await res.json(), api.list.items_path);
+    if (!Array.isArray(page)) throw new Error(`Provider response carried no key list at ${api.list.items_path}`);
+    keys.push(...page);
+    if (page.length < api.list.page_size) break;
+  }
+  return keys.map((item) => {
+    const held = rows.filter((row) => row.provider_key_id === item.hash || (row.fingerprint && String(item.hash).startsWith(row.fingerprint))).map((row) => row.key);
+    return { hash: item.hash, name: item.name ?? null, label: item.label ?? null, disabled: item.disabled === true, usage: item.usage ?? null, last_used_at: item.last_used_at ?? null, created_at: item.created_at ?? null, stored_as: held };
+  });
+}
+
+/** Revoke one key by its unique hash prefix. A key the store still holds is refused: rotate it instead. */
+export async function revokeProviderKey({ brainDir, provider, hash, readSecret, listRows, fetchImpl = fetch }) {
+  if (typeof hash !== 'string' || hash.length < 8) throw new Error('Give at least 8 characters of the key hash');
+  const keys = await listProviderKeys({ brainDir, provider, readSecret, listRows, fetchImpl });
+  const matches = keys.filter((item) => item.hash.startsWith(hash));
+  if (matches.length !== 1) throw new Error(`Hash ${hash} matches ${matches.length} provider keys; exactly one is required`);
+  const [target] = matches;
+  if (target.stored_as.length) throw new Error(`Refusing to revoke a key the store still holds: ${target.stored_as.join(', ')}. Rotate it instead.`);
+  const { api, auth } = await managementContext(provider, readSecret, brainDir);
+  const res = await fetchImpl(`${api.base_url}${api.revoke.path(target.hash)}`, { method: api.revoke.method || 'DELETE', headers: auth });
+  if (!res.ok) throw new Error(`Provider refused to revoke the key (HTTP ${res.status})`);
+  return { ok: true, revoked: target.hash, name: target.name, label: target.label };
+}

package/scaffold/.agent/skills/total-recall/plugins/auth/src/provider-catalog.mjs

@@ -122,6 +122,7 @@ export const PROVIDER_CATALOG = [
           value_path: 'key',
           id_path: 'data.hash',
         },
+        list: { path: '/keys', items_path: 'data', page_size: 100 },
         revoke: {
           method: 'DELETE',
           path: (id) => `/keys/${id}`,

package/scaffold/.agent/skills/total-recall/plugins/auth/src/secrets-remote-deploy.mjs

@@ -262,6 +262,13 @@ function findTarget(brainDir, targetName) {
   return target;
 }
 
+/** Names in a parsed env file whose value has this fingerprint: how to find a credential's consumers without reading it. */
+export function holdersOfFingerprint(remote, fingerprint) {
+  const wanted = String(fingerprint);
+  if (wanted.length < 8) throw new Error('--find-fingerprint needs at least 8 characters');
+  return [...remote.entries()].filter(([, found]) => secretValueFingerprint(found.value)?.startsWith(wanted)).map(([key]) => key);
+}
+
 /**
  * Compare a deployed remote file with what the store would project there, key
  * by key, by value fingerprint. Values never leave this process.
@@ -294,6 +301,7 @@ export async function verifyRemote(brainDir, targetName, opts = {}) {
     remoteFile,
     rows,
     remoteOnly: [...remote.keys()].filter((key) => !projected.has(key)),
+    ...(opts.findFingerprint ? { holders: holdersOfFingerprint(remote, opts.findFingerprint) } : {}),
     ok: rows.every((row) => row.status === 'match' && !row.duplicates),
   };
 }

package/scaffold/.agent/skills/total-recall/plugins/auth/src/secrets-rotate.mjs

@@ -23,7 +23,7 @@ import { getProvider, providerForKeyName } from './provider-catalog.mjs';
 import { atomicWrite, safeStringify } from './vault.mjs';
 import { getRotationPlan, generateSecretValue } from './rotation-capability.mjs';
 import { getRecipe, valueLooksValid } from './provider-rotation-recipes.mjs';
-import { rotateViaProviderApi } from './provider-api-rotation.mjs';
+import { rotateViaProviderApi, listProviderKeys, revokeProviderKey } from './provider-api-rotation.mjs';
 import {
   launchRotationContext,
   openConsole,
@@ -470,6 +470,7 @@ export async function rotateAuto(brainDir, key, opts = {}) {
         actor: o.actor, exportEnv: opts.exportEnv !== false,
       }),
       secretMeta: async (brain, name) => (await listSecretsMeta(brain)).find((r) => r.key === name) || null,
+      listRows: listSecretsMeta,
       // Remember which key the provider minted, so the next rotation can revoke this one instead of
       // reporting that the previous credential cannot be addressed.
       recordKeyId: async (brain, name, id) => {
@@ -492,3 +493,21 @@ export async function rotateAuto(brainDir, key, opts = {}) {
     console_url: plan.console_url,
   };
 }
+
+const storedSecret = async (brain, name) => {
+  try {
+    const found = await getSecret(brain, name);
+    if (!found || found.found === false) return null;
+    const value = found.value ?? found;
+    return typeof value === 'string' && value ? value : null;
+  } catch { return null; }
+};
+
+/** List the provider account's keys, or revoke one that the store no longer holds. */
+export async function manageProviderKeys(brainDir, providerId, { revoke, fetchImpl } = {}) {
+  const provider = getProvider(providerId);
+  if (!provider) throw new Error(`Unknown provider: ${providerId}`);
+  const context = { brainDir, provider, readSecret: storedSecret, listRows: listSecretsMeta, ...(fetchImpl ? { fetchImpl } : {}) };
+  if (revoke) return revokeProviderKey({ ...context, hash: revoke });
+  return { ok: true, provider: provider.id, keys: await listProviderKeys(context) };
+}